The 2025-2028 State Homeland Security Strategy is a funding-allocation framework, not a procurement catalog. But for companies that understand how it works, it maps a substantial range of opportunities across seven goals and multiple active funding streams.
North Carolina’s 2025-2028 State Homeland Security Strategy is built around seven goals, 42 objectives, and the FEMA-defined five mission areas of prevention, protection, mitigation, response, and recovery. It guides how federal homeland security grant dollars — primarily the Homeland Security Grant Program and the State and Local Cybersecurity Grant Program — flow through the state’s grant cycle to agencies and local governments.
The strategy itself is not self-executing. The money moves through NCEM’s grant cycle, through the State Emergency Response Commission, and through the state’s seven Domestic Preparedness Regions. Those are the actual gatekeepers — not the strategy document. But for companies evaluating where North Carolina’s homeland security investment is heading, the strategy is the clearest available signal of intent. Here is what full operationalization would open up, goal by goal.
Intelligence and Information Sharing
The most concrete near-term signal in the strategy is the planned co-location of the Joint Cyber Task Force with NC’s intelligence fusion center. That project creates demand for SCIF-grade construction and physical security, secure network engineering, and the integration of cyber and physical intelligence platforms in a single facility. Beyond that, the strategy’s emphasis on expanding field liaison officers and strengthening the state’s information-sharing infrastructure points toward fusion center case management software, open-source intelligence tools, link analysis platforms, and analyst training and credentialing programs.
Counterterrorism and Targeted Violence Prevention
The strategy calls for continued investment in bomb squad capabilities and explosive detection — including canine programs — creating sustained demand for EOD equipment, robotic platforms, imaging systems, and detection technology.
The targeted violence prevention framework has already begun to take shape in law. House Bill 605, signed by Governor Cooper in July 2023 and effective beginning with the 2024-25 school year, requires all public school districts and charter schools in North Carolina to establish multidisciplinary threat assessment teams — composed of counselors, school administrators, law enforcement, and mental health professionals — and peer-to-peer support programs in schools serving sixth grade and above. That legislative foundation creates ongoing demand for behavioral threat assessment software, clinical threat management services, training programs, and the staffing and support infrastructure required to sustain those teams at scale across more than 100 school districts statewide.
The drug trafficking and organized criminal enterprise objectives add a separate category: license plate recognition systems, surveillance equipment, analytics platforms for financial crimes, and investigative support tools that help agencies identify and track complex criminal networks operating across jurisdictional lines.
Cybersecurity — The Highest-Density Opportunity
With nine objectives, cybersecurity is the most extensive section in the strategy and the highest-density opportunity category for companies positioned to serve it. The strategy calls for hardening networking infrastructure with modern technologies — a signal for zero trust network access, next-generation firewalls, network segmentation, and SIEM modernization. A specific objective targets the identification of state, local, and critical infrastructure agencies relying on operational technology, opening significant space for OT and industrial control system security capabilities that have historically been underpenetrated in state and local government.
Incident response retainers, digital forensics, and ransomware recovery services are addressed directly. Cybersecurity workforce development — training, certification, apprenticeship programs, and university partnerships — is explicitly called out. And the strategy’s treatment of artificial intelligence risks and benefits creates early-mover opportunity for AI governance tooling, deepfake detection, and AI-augmented security operations platforms.
The State and Local Cybersecurity Grant Program is the primary funding vehicle here, with approximately $2.64 million in active federal allocation to North Carolina and an 80% pass-through requirement to local governments. Companies that can reach those local entities — rather than waiting for state-level procurement — will have broader access to this funding stream. Getting onto the state’s cybersecurity convenience contract is the single highest-leverage positioning move for vendors in this category.
Critical Infrastructure Protection
The strategy’s critical infrastructure goals address energy sector security and transportation sector resilience specifically — covering substation hardening, perimeter security, counter-UAS capabilities for high-value sites, and physical-cyber convergence work at ports, airports, and rail facilities. Vulnerability assessment services aligned with CISA methodologies are explicitly called out, creating a pathway for firms with CISA-approved assessor credentials.
The school safety objectives within this goal extend beyond the behavioral threat assessment work established by HB 605 into physical security: access control systems, weapons detection platforms, mass notification systems, lockdown technology, and safe room construction. The threat assessment framework is now operational — the physical security layer is the next implementation gap.
Emergency Communications
The communications goal contains several discrete and addressable opportunities. The strategy explicitly commits to developing purchasing standards for communications technologies in furtherance of federal grant eligibility — which means companies that engage early in that standards-setting process will have a structural advantage when procurement follows. Redundant communications infrastructure — satellite systems, deployable cellular platforms, mesh networking, and FirstNet integration — is called out directly. So are encrypted radio upgrades, key management systems, and the replacement of outdated land mobile radio and console equipment. A separate continuity of government communications requirement covers secure mobile platforms and deployable executive communications systems for senior officials and non-traditional practitioners.
All-Hazards Preparedness and Event Security
The strategy’s all-hazards goal creates demand for proactive event security planning — consulting, tabletop exercise design, and operational planning support for large venues, airports, and major public events. North Carolina’s growth in professional sports infrastructure, major university venues, and large-scale public gatherings makes this a category with genuine and expanding scope. The Special Event Assessment Rating framework ties directly into federal homeland security planning requirements, creating a recurring engagement model for firms with planning and exercise expertise.
Hurricane Helene Recovery — The Largest Near-Term Spend
The disaster recovery appropriations represent the largest immediate opportunity connected to the homeland security strategy. The Disaster Recovery Acts of 2025 — Parts I and II — together push enacted relief past $2.1 billion, funding infrastructure hardening, flood mitigation, dam rehabilitation, local airport accessibility improvements, and a forthcoming Disaster Recovery Constituent Portal from NCDIT that will require system integration work. While Helene recovery is not a homeland security line item in the traditional sense, it maps directly to the strategy’s infrastructure protection and all-hazards preparedness goals and is generating active procurement across multiple categories.
What to Watch
Two legislative developments could significantly reshape the opportunity landscape. HB 808 — the NC Infrastructure Protection Act — would prohibit government contracts with companies tied to adversarial foreign governments and require criminal history checks for contractors accessing critical infrastructure. If enacted, it creates both new compliance requirements and new background check and credentialing service demand. SB 667 — Government Modernization — would mandate multi-factor authentication, encryption standards, mandatory cyber training, and a State Cybersecurity Task Force. It has not moved to enactment but mirrors Goal 3 objectives closely and signals where legislative attention is focused.
The strategy is a map of intent. The dollars move through the grant cycle, the disaster recovery appropriations, and the seven Domestic Preparedness Regions. Companies that understand the difference between what the strategy signals and how implementation actually works — and that position accordingly — will have a meaningful advantage over those treating this as a standard government procurement opportunity.